Merge of #2083

Author: mergify[bot]

.github/CODEOWNERS

@@ -18,3 +18,7 @@ test-suite/gateway-stress/Dockerfile @zama-ai/fhevm-devs
 
 # Coprocessor Team ownership
 /coprocessor/ @zama-ai/fhevm-coprocessor
+
+# Enforces changes in Sandboxed AI CI/CD
+.github/squid/sandbox-*.conf @zama-ai/infosec 
+.github/workflows/claude-*.yml @zama-ai/infosec 

.github/squid/sandbox-proxy-rules.conf

@@ -0,0 +1,18 @@
+# Strict domain allowlist for CI sandbox
+# Only these domains are reachable through the Squid proxy.
+# Based on: https://github.com/zama-ai/security-hub/tree/main/docs/how-tos/sandboxed-claude-code
+#
+# To add a new domain: append ".example.com" to the acl below.
+# Leading dot means "this domain and all subdomains".
+
+acl allowed_domains dstdomain \
+  .api.anthropic.com \
+  .platform.claude.com \
+  .github.com
+
+# Allow only explicitly allowed domains
+http_access deny !allowed_domains
+http_access allow allowed_domains
+
+# Deny everything else
+http_access deny all